Mastodawn

r2flutter is moving at good pace. Still not yet ready for a release, but quite usable for both iOS and Android. It’s about 3000 LOC, and i’m still trying to stabilize the parsing and carving of all the metadata for strings, class hierarchies, type information and so on.

Dart is tricky but I hope this cli tool and #radare2 plugin will make a difference for reversing Flutter apps when released next month.

codecolorist Feb 20

@pancake can’t wait to integrate it with my web tool

@codecolorist your web tool?

codecolorist Feb 20

@pancake Mobile Pentester IDE wannabe

@codecolorist that looks so cool! (And useful) You must submit a blue/yellow color theme for r2 to match the style! I can do as template if you like

codecolorist Feb 24

@pancake I'd digg the rabbit hole to put hermes plugin first

@codecolorist wow that looks great 🔥are also interested in my upcoming plugins for flutter and unity?

codecolorist Feb 24

@pancake will eventually have them but now I haven’t figure out how to even extract dark bytecode from runtime

@codecolorist @pancake whoa, is this thing for going after mobile apps?

codecolorist Feb 24

@codecolorist ooooooooo. i have a potential gig coming up where i have to go after mobile apps :D

codecolorist 2d ago

@pancake hermes is done

@codecolorist yay! that's fantastic! definitively you need to do your own color theme for r2!

codecolorist 19h ago

@pancake :-> reinventing goes too far

@codecolorist @pancake so im a complete reversing noob. the deepest i got into it was the OSCP in 2009 (basic buffer overflow with dep/aslr disabled) and then a few years later making a SINGLE BYTE change to vncpasswd to allow for 1 char passwords.

ive always wanted to chuck an apk into something like this and go to town tearing out hardcoded api keys and whatnot. for a reversing nooblet like me, is this just way overboard, or do you think i could light it up and survive?

codecolorist 19h ago

@Viss this thing should be easy to learn, especially with llm. You might have some problem with RASP for real world apps because all of them try to hide the binary from reverser now

@codecolorist that's very cool

What are you using for the graphs btw, mermaid or something else? I would love to implement similar UI for r2web

codecolorist 3h ago

@AbhiTheModder https://github.com/ChiChou/grapefruit/blob/b4013b7009efae8521c39d0fc715e60481ad3381/gui/src/components/shared/CFGView.tsx dagre

and you need to replace agfm with agfj

https://github.com/ChiChou/grapefruit/commit/08ff575d42360e1a097ac38a0e8fbce8985ad9cb#diff-f159b0ab752795015d7b392012e6e895d4a8e6e2d071ac592ec3f151d3b6a9f8R18-R92

grapefruit/gui/src/components/shared/CFGView.tsx at b4013b7009efae8521c39d0fc715e60481ad3381 · ChiChou/grapefruit

(WIP) Runtime Mobile Application Pentest Tool for iOS and Android. Previously Passionfruit - ChiChou/grapefruit

GitHub

codecolorist 2h ago

@pancake one request.. r2hermes xref eta wen

ablobcatpopcorn

@codecolorist sure, @ahmethan (or me) will take a look! btw, do you have patches for r2hermes or r2 that are not pushed into the main repos?

codecolorist 15m ago

@pancake no, I grab plain build from wasi-api to avoid GPL issues. For r2hermes it’s only a plain emcc build

@codecolorist oh neat! Maybe good to have emcc builds for r2hermes in the CI then! btw, soon i'll merge another thing that you can probably enjoy too: https://github.com/radareorg/radare2/pull/25661

Import the gopc anal plug vibetranspiled from the python one by trufae · Pull Request #25661 · radareorg/radare2

https://github.com/AsherDLL/r2gopclntabParser Mark this if you consider it ready to merge I've added tests (optional) I wrote some lines in the book (optional) Description

GitHub

ahmethan Feb 24

@codecolorist @pancake looks fantastic!